[DO NOT MERGE] Add support for async io

[sfc-gh-turbaszek]

Please answer these questions before submitting your pull requests. Thanks!

1. What GitHub issue is this PR addressing? Make sure that there is an accompanying issue to your PR.

   Fixes #NNNN

2. Fill out the following pre-review checklist:

   • I am adding a new automated test(s) to verify correctness of my new code
   • I am adding new logging messages
   • I am adding a new telemetry message
   • I am modifying authorization mechanisms
   • I am adding new credentials
   • I am modifying OCSP code
   • I am adding a new dependency

3. Please describe how your code solves the related issue.

   Please write a short description of how your code change solves the related issue.

4. (Optional) PR for stored-proc connector:

To fix the problem, we must ensure that sensitive data such as passwords, passcodes, authentication tokens, and related credentials are never logged, regardless of whitelist configuration. The best way to do this is to explicitly identify and mask all such keys in the data before logging, overriding any whitelist logic. We should define a set of sensitive keys ({"PASSCODE", ...}) and always redact these in any log output. The edit is localized to the debug log statement, so add a hardcoded redaction for sensitive keys regardless of the whitelist, e.g., always replacing the value of keys like "PASSCODE" with "******".

In src/snowflake/connector/aio/auth/_auth.py:

• Add a definition near the log statement for a set of sensitive keys.
• Change the dictionary comprehension for logging so that if a key is in the set of sensitive keys (case-insensitive), the value is always masked as "******", regardless of the whitelist. For non-sensitive keys, continue with the previous logic.
• No new dependencies are required.

Only code in the shown snippet (lines 141-152) needs modification.

---

To fix this problem, replace the substring or startswith match with a robust check that uses URL parsing to check host and port explicitly. Specifically, use Python's standard library function urllib.parse.urlparse to split the URL into components, then assert the host and port match the expected values. For the affected area (lines 719–721), parse the relevant URL and confirm that the hostname is "test-account.snowflakecomputing.com" and the port is "443". This avoids the risk of accidental matches due to substring tricks, and mirrors best-practice checking. Only modify the assertion logic within this test, and add any needed imports (in this case, from urllib.parse import urlparse) at the top of the file or in this region.

To correctly check whether the log line includes an Azure blob storage URL (i.e., whether the hostname is actually blob.core.windows.net or a subdomain such as *.blob.core.windows.net), parse any URLs found in the log line, and check if any of their parsed hostnames end with .blob.core.windows.net or are exactly blob.core.windows.net.

Since log lines may contain more than just URLs, search each line for substrings that look like URLs (e.g., using re.findall with a URL pattern), and then use urllib.parse.urlparse to extract and analyze the hostname.

Required changes:

• Add an import for re and for urlparse (from urllib.parse import urlparse).
• Replace the condition at line 97 so that, for each line in caplog.text.splitlines(), all URLs within the line are parsed, and their hostnames checked to ensure that hostname is exactly or ends with .blob.core.windows.net.
• If any such URL is found and contains the expected token, trigger the assertion.

---

To fix this vulnerability, update the rsa.generate_private_key() call to use a key_size of at least 2048 bits in place of the current 1024. This change will ensure the generated RSA key meets current security best practices and cryptographic standards. You do not need to change any logic or functionality; simply replace key_size=1024 with key_size=2048 or greater in the affected function. No new imports or definitions are required, and the fix should be made in test/unit/test_ocsp.py within the create_x509_cert function.

---